| suricata |
ET INFO NTLM Session Setup Request - Auth |
rev 1 |
2026-01-26 |
| suricata |
ET INFO NTLM Session Setup Request - Negotiate |
rev 1 |
2026-01-26 |
| suricata |
ET HUNTING Large non-DNS Packet on Port 53 |
rev 1 |
2026-01-26 |
| sigma |
Vulnerable Driver Blocklist Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine |
experimental |
2026-01-26 |
| sigma |
Windows Vulnerable Driver Blocklist Disabled |
experimental |
2026-01-26 |
| sigma |
Registry Modification for OCI DLL Redirection |
experimental |
2026-01-24 |
| sigma |
XSL Script Execution Via WMIC.EXE |
test |
2026-01-24 |
| sigma |
Suspicious Shell Open Command Registry Modification |
experimental |
2026-01-24 |
| sigma |
Potential Remote SquiblyTwo Technique Execution |
test |
2026-01-24 |
| sigma |
Shai-Hulud Malicious GitHub Workflow Creation |
experimental |
2026-01-24 |
| sigma |
Linux Setgid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| sigma |
Capabilities Discovery - Linux |
test |
2026-01-24 |
| sigma |
Cmd Launched with Hidden Start Flags to Suspicious Targets |
experimental |
2026-01-24 |
| sigma |
Registry Modification of MS-settings Protocol Handler |
test |
2026-01-24 |
| sigma |
Potential DLL Sideloading Of Non-Existent DLLs From System Folders |
test |
2026-01-24 |
| sigma |
Creation Of Non-Existent System DLL |
test |
2026-01-24 |
| sigma |
Linux Setuid Capability Set on a Binary via Setcap Utility |
experimental |
2026-01-24 |
| snort |
ET TROJAN HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| snort |
ET CURRENT_EVENTS Microsoft Phish Landing Page M1 2026-01-22 |
rev 1 |
2026-01-22 |
| suricata |
ET MALWARE HTTP Request to Known Stealer Payload Delivery Host |
rev 1 |
2026-01-22 |
| suricata |
ET PHISHING Microsoft Phish Landing Page M1 2026-01-22 |
rev 1 |
2026-01-22 |
| snort |
ET TROJAN EvilNginx Fake Captcha Page Request |
rev 1 |
2026-01-21 |
| snort |
ET CURRENT_EVENTS EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| snort |
ET CURRENT_EVENTS EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilNginx Fake Captcha Page Request |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| suricata |
ET PHISHING EvilGinX Fake Captcha Landing Page |
rev 1 |
2026-01-21 |
| snort |
ET EXPLOIT F5 BIG-IP - Successful Password Reset Attempt - Observed Post CVE-2023-46747 Activity |
rev 3 |
2026-01-20 |
| snort |
ET INFO Python aiohttp User-Agent Observed Inbound |
rev 2 |
2026-01-20 |
| snort |
ET INFO PDQ Remote Management Agent HTTP Activity |
rev 2 |
2026-01-20 |
| snort |
ET INFO Flowise Reset Password with tempToken |
rev 3 |
2026-01-20 |
| snort |
ET INFO SonicWall SMA Multiple CIFS Server Bookmark Creation |
rev 2 |
2026-01-20 |
| snort |
ET INFO Flowise Exposed User tempToken |
rev 3 |
2026-01-20 |
| snort |
ET EXPLOIT F5 BIG-IP - Successful Command Execution via util/bash |
rev 3 |
2026-01-20 |
| snort |
ET INFO DYNAMIC_DNS Query to a *.kawaiiarts .com domain |
rev 1 |
2026-01-20 |
| snort |
ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet M2 |
rev 2 |
2026-01-20 |
| snort |
ET INFO DYNAMIC_DNS HTTP Request to a *.kawaiiarts .com domain |
rev 1 |
2026-01-20 |
| snort |
ET INFO Possible NOP Sled Observed in Large DNS over TCP Packet M1 |
rev 2 |
2026-01-20 |
| snort |
ET EXPLOIT F5 BIG-IP - Password Reset Attempt - Observed Post CVE-2023-46747 Activity |
rev 3 |
2026-01-20 |